Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We got attacked by some very-bored teenagers registering in our forums and posting very explicit material using anonymous proxy websites, like

Is there a way to check the registration IP against a black list database? Has anyone experienced this and had success?

Sorry, it didn't link my account from StackOverflow to here :(

Anyway, I used and got an IP of, unfortunately, Spamhaus doesn't list that IP?

share|improve this question

migrated from May 15 '10 at 8:06

This question came from our site for professional and enthusiast programmers.

And you know these are bored teenagers because...? – John Gardeniers May 15 '10 at 11:32

[ not tested, just some thoughts ]:

what you can try to do is to check ips of posters against couple of rbl servers [ just as it is done with e-mail ]. list of some rbls that can help you: problem is such approach will introduce significant delay and degrade user experience. you can combine it together with local geoip database [ eg from maxmind ] and apply the check only to those who are coming from 'suspicious' directions.

there are also paid services that will keep updated list of proxies - eg killabot. if you are willing to pay there should be no problem with modifying their wordpress protection script and using for your website.

share|improve this answer
Its only a matter of time before you are hacked though Wordpress. – Rook May 15 '10 at 9:01
@The Rook - well - i'm talking about using this mechanizm with whatever custom application mmgn has. nothing more nothing less; besides i believe if you keep things updated [ both your php ecosystem and the blog engine itself ] - you are pretty safe. sure - if you lag behind you will get owned sooner or later. – pQd May 15 '10 at 9:10

Many proxies are tracked by the Spamhaus project. Specifically the SBL and XBL should be used for this purpose. You can use Squid to deny hosts that are on these black lists.

There are also for pay services. And you could even check the "x-forwarded-for" header, but "anonymous proxies" wont' set this variable. Further more this is an attacker controlled variable and can never really be trusted.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.